CVE-2018-0732: Client DoS due to large DH parameter

Published Jun 12, 2018
·
Updated

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

Other sources

OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server during key agreement in a TLS handshake. By spending an unreasonably long period of time generating a key for this prime, a remote attacker could exploit this vulnerability to cause the client to hang.

IBM

OpenSSL versions 1.1.0 to 1.1.0h and 1.0.2 to 1.0.2o allow malicious servers to send very large primes to a client during DH(E) based TLS handshakes. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack.

External Reference:

https://www.openssl.org/news/secadv/20180612.txt

Upstream Patches:

https://github.com/openssl/openssl/commit/ea7abeeabf92b7aca160bdd0208636d4da69f4f4 https://github.com/openssl/openssl/commit/3984ef0b72831da8b3ece4745cac4f8575b19098

Red Hat

Affected Software

17 affected componentsFixes available
redhat/openssl<1.1.0
1.1.0
redhat/openssl<1.0.2
1.0.2
IBM Security Verify Governance<=10.0
OpenSSL OpenSSL>=1.0.2<=1.0.2o
OpenSSL OpenSSL>=1.1.0<=1.1.0h
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=17.10
Canonical Ubuntu Linux=18.04
Debian Debian Linux=8.0
Nodejs Node.js>=6.0.0<6.8.1
Nodejs Node.js>=6.9.0<6.14.4
Nodejs Node.js>=8.0.0<8.8.1
Nodejs Node.js>=8.9.0<8.11.4
Nodejs Node.js>=10.0.0<10.9.0
debian/openssl
1.1.1w-0+deb11u11.1.1w-0+deb11u53.0.18-1~deb12u13.0.18-1~deb12u23.5.4-1~deb13u13.5.4-1~deb13u23.5.5-1

Event History

Jun 12, 2018
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionWeakness
Jun 14, 2018
Data Sourced
via Red Hat·05:11 AM
DescriptionSeverityAffected Software
Feb 19, 2026
Data Sourced
via Ubuntu·07:35 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·07:36 PM
Description
Feb 24, 2026
Data Sourced
via Debian·07:39 PM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the vulnerability ID?

The vulnerability ID is CVE-2018-0732.

2

What is the severity of CVE-2018-0732?

The severity of CVE-2018-0732 is high with a severity value of 7.5.

3

What is the affected software?

The affected software includes OpenSSL versions 1.0.2 and 1.1.0, as well as various Ubuntu Linux and Debian versions.

4

How does CVE-2018-0732 work?

During a TLS handshake using a DH(E) based ciphersuite, a malicious server can send a very large prime value to the client, causing the client to spend an unreasonably long time generating a key for this prime and resulting in a hang.

5

Are there any available remedies for CVE-2018-0732?

Yes, there are available remedies provided by Red Hat, Canonical, Ubuntu, and Debian. Please refer to the respective sources for the specific versions and updates.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203